fix(magic env) HEX secrets creating double the length of their name#9820
fix(magic env) HEX secrets creating double the length of their name#9820yipfram wants to merge 2 commits intocoollabsio:nextfrom
Conversation
There was a problem hiding this comment.
Pull request overview
Fixes the generated length of SERVICE_HEX_* magic environment variables so the produced hex string matches the size indicated by the suffix (e.g., _64 => 64 hex chars), rather than being doubled.
Changes:
- Adjust
HEX_32,HEX_64, andHEX_128generation to use half-length inputs beforebin2hex(), producing the intended output length.
| $generatedValue = bin2hex(Str::random(16)); | ||
| break; | ||
| case 'HEX_64': | ||
| $generatedValue = bin2hex(Str::random(64)); | ||
| $generatedValue = bin2hex(Str::random(32)); |
There was a problem hiding this comment.
bin2hex(Str::random(...)) hex-encodes an alphanumeric string (ASCII bytes), not raw random bytes, which reduces entropy and produces a biased hex distribution. For cryptographic secrets, generate bytes with random_bytes() (or an equivalent crypto-safe byte generator) and then bin2hex() those bytes, keeping the requested output length consistent (e.g., 32 hex chars => 16 bytes).
| case 'HEX_32': | ||
| $generatedValue = bin2hex(Str::random(32)); | ||
| $generatedValue = bin2hex(Str::random(16)); | ||
| break; | ||
| case 'HEX_64': | ||
| $generatedValue = bin2hex(Str::random(64)); | ||
| $generatedValue = bin2hex(Str::random(32)); |
There was a problem hiding this comment.
There are no unit tests asserting the output lengths for the HEX_* magic variables, and this change alters those lengths. Add/extend a unit test that calls the env-generation path and verifies that HEX_32/64/128 produce exactly 32/64/128 hex characters (and valid hex).
Changes
Str::randomIssues
Fixed
SERVICE_HEX_64or 32 or 128 generating double their size nameSERVICE_HEX_64would create a 128-character chain, 32=>64 and 128=>256Because hex = 2 characters when converting.
Category
Preview
AI Assistance
If AI was used:
Testing
I could not test it in local environment for coolify, i can't get it to run.
I did test by using SERVICE_HEX_32 to generate a 64 character secret, it works.
Contributor Agreement
Important